Skip to main content

CCTV - Council Buildings and Establishments

 

Privacy notice relating to the processing of personal data by Rhondda Cynon Taf County Borough Council, captured by CCTV that are in operation in Council owned/occupied buildings, premises and establishments

Introduction

This privacy notice is intended to provide information about how Rhondda Cynon Taf County Borough Council (referred to as ‘RCTCBC, ‘Council’, ‘Local Authority’ or ‘we’) will use (or ‘process’) personal data about individuals whose image is captured by the CCTV systems that are  in operation in Council owned or occupied buildings, premises and establishments. Such buildings, premises etc. may include but are not limited to:

  • Leisure Centres
  • Libraries
  • Museums
  • Theatres
  • Community Centres
  • Civic Amenity Sites / Recycling Centres 
  • Council Offices

Where CCTV is in operation at a building or premise this will be clearly indicated through signage.

This privacy notice does not cover the personal data captured by the Council’s Public Open Spaces CCTV system. For further information relating to this please see the Public Open Spaces CCTV privacy notice.

This notice should be read in conjunction with the Council’s corporate privacy notice.

The Data Controller

The Council is the data controller for the personal data captured by the CCTV systems that are in operation in or around Council owned or occupied buildings, premises and establishments.

The Council is registered with the Information Commissioner’s Office (ICO) as a controller under reference Z4870100.

Queries relating to this privacy notice

If you have any questions or queries relating to this privacy notice please contact the Council’s  CCTV department:

By email : cctvvisitor@rctcbc.gov.uk

By telephone : 01443 425005

By post: CCTV Control Centre, Ty Elai, Williamstown, TONYPANDY, RCT, CF40 1NY

The categories of personal data we process

We process the images of individuals captured by the CCTV system.

We do not capture audio via the CCTV system.

Whilst we do not deliberately set out to capture any other personal data, indirectly CCTV images may capture other information about individuals such as a health issue, criminal offence data (e.g. if CCTV captures a potential crime being committed) etc.

Whose personal data we process

We process the personal data of individuals whose images are captured by the system. This may include but is not limited to the following, depending on the premise or establishment and the purpose for which it is used:

  • Council employees
  • Customers
  • Visitors
  • Contractors
  • Public

Why we process the personal data

We process the personal data captured by the CCTV system to;

  • help detect, prevent, deter and reduce crime
  • enhance the general security of Council owned/occupied buildings, premises, establishments and assets
  • enhance the health and safety of our employees, visitors and users of our buildings, premises, establishments
  • for safeguarding purposes
  • assist with complaints or concerns (i.e. CCTV images may be used to support an investigation into a complaint or concern).
  • assist with legal or insurance claims (i.e. CCTV images may be used as evidence to support or defend a claim)

Our lawful basis for processing the personal data

Under the General Data Protection Regulation (GDPR) and Data Protection Act 2018, our lawful basis for processing the personal data captured by the CCTV system is;

Purpose

Lawful Basis

Detect, prevent, deter and reduce crime

 

 

 

Personal Data:

  • Public Task - Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Special Category Data:

  • Substantial public interest - Article 9 (2) (g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
  • Data Protection Act, Schedule 1, Part 2, 6  - Statutory and Government purposes
  • Data Protection Act, Schedule 1, Part 2, 10 – Preventing and detecting unlawful acts

Criminal Offence Data:

  • Data Protection Act, Schedule 1, Part 2, 6  - Statutory and Government purposes
  • Data Protection Act, Schedule 1, Part 2, 10 – Preventing and detecting unlawful acts

Enhance the general security of Council owned/occupied buildings, premises, establishments and assets

 

 

 

 

 

Personal Data:

  • Public Task - Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Special Category Data:

  • Substantial Public Interest - Article 9 (2) (g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
  • Data Protection Act, Schedule 1, Part 2, 6  - Statutory and Government purposes

Criminal Offence Data:

  • Data Protection Act, Schedule 1, Part 2, 6  - Statutory and Government purposes

 

Enhance the health and safety of our employees, visitors and users of our buildings, premises, establishments &

for safeguarding purposes

 

 

 

Personal Data:

  • Legal Obligation – Article 6(c) - processing is necessary for compliance with a legal obligation to which the controller is subject
  • Public Task - Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Special Category Data:

  • Substantial public interest - Article 9 (2) (g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
  • Data Protection Act, Schedule 1, Part 2, 6  - Statutory and Government purposes

Criminal Offence Data:

  • Data Protection Act, Schedule 1, Part 2, 6  - Statutory and Government purposes

Supporting Legislation:

  • The Management of Health & Safety at Work Act 1999
  • The Health & Safety at Work Act 1974
  • The Education Act 2022 (Section 175)

Assist with complaints or concerns

 

Personal Data:

  • Public Task - Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Special Category Data:

  • Substantial public interest - Article 9 (2) (g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
  • Data Protection Act, Schedule 1, Part 2, 6  - Statutory and Government purposes

Criminal Offence Data:

  • Data Protection Act, Schedule 1, Part 2, 6  - Statutory and Government purposes

Assist with legal or insurance claims

 

Personal Data:

  • Legitimate Interests - Article 6(f) GDPR - processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Special Category Data:

  • Legal Proceedings - Article 9(f) GDPR processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

Criminal Offence Data:

  • Data Protection Act, Schedule 1, Part 3, 33 – Legal Claims

The primary legislation, regulations and guidance that supports the processing includes, but is not limited to;

  • Criminal Justice and Public Order Act 1994 - Section 163 of the Criminal Justice and Public Order Act 1994 creates the power for local authorities to provide closed circuit television coverage of any land within their area for the purposes of crime prevention or victim welfare and it is also considered a necessary initiative under the Crime and Disorder Act 1998.
  • Criminal Procedures and Investigations Act 1996
  • Human Rights Act 1998
  • Regulatory and investigatory Powers Act 2000
  • Surveillance Camera Code of Practice

Who or where we get the personal data from

We obtain the personal data directly from the individuals whose image is captured by the CCTV system.

Who we share personal data with

We do not routinely share CCTV footage with external organisations. However, access to CCTV footage may be requested by and disclosed to third parties, for the following purposes, where the law allows us to do so (we have listed below the most common types of requests received. Please note this list is not exhaustive)

Requests for personal data captured by CCTV will be dealt with on a case-by-case basis.

Police and law enforcement agencies

Personal data captured by CCTV may be shared with the Police for the purpose of;

  • Prevention and detection of crime
  • Apprehension or prosecution of offenders
  • Legal proceedings

Courts

Personal data captured by CCTV may be shared with the Courts for the purpose of;

  • Legal proceedings
  • Court Order

Solicitors and Legal Representatives etc.

Personal data captured by CCTV may be shared with Legal Representatives for the purpose of;

  • Legal proceedings

Insurance companies, claim handlers etc.

Personal data captured by CCTV may be shared with Insurance companies for the purpose of;

  • Legal proceedings

Health & Safety Executive

Personal data captured by CCTV may be shared with the Health & Safety Executive and other relevant agencies to support an investigation.

Internal purposes

We may use and share images captured by CCTV for our own internal purposes as follows.

Please note this list is not exhaustive.

Purpose

Who we may share the images with for this purpose and why

To assist with a complaint

Service Department – images may be shared, if appropriate, relevant and necessary, to seek advice, support and guidance etc. in line with the Complaints procedures.

 

Human Resources – where the complaint relates to a member of staff etc. images may be shared, if appropriate, relevant and necessary, for the purpose of seeking advice, support and guidance etc. in relation to any potential disciplinary matter.

 

Information Management / Data Protection Officer – where the complaint relates to a data protection matter, images may be shared, if appropriate, relevant and necessary, to seek advice, support, guidance etc. and to investigate any potential personal data breach.

To assist with a streetcare enforcement matter

Streetcare Enforcement team – images may be shared if appropriate, relevant, and necessary, for the purpose of dealing with fly tipping, littering (e.g., as evidence to support a fine and or prosecutions, where the incident has been captured by CCTV).

To assist with an Insurance Claim

Insurance Section – images may be shared with the Insurance Section and the Council’s Insurance Company/Claims Handler, if appropriate, relevant, and necessary, for the purpose of dealing with a claim (e.g., as evidence to support claim where the incident has been captured by CCTV).

To assist with a staff disciplinary matter

Human Resources (RCTCBC) - images may be shared, if appropriate, relevant and necessary, for the purpose of seeking advice, support and guidance etc. in relation to any disciplinary matter.

Data Processors

A data processor is a company or organisation that processes personal data on our behalf. Our data processors act only upon our instruction. They cannot do anything with the personal data unless we instruct them to do so. They will not share the personal data with any organisation apart from us or use it for their own purposes. They will hold it securely and retain it for the period we instruct.

The categories of data processors we use for the purpose of maintaining the system are;

  • CCTV system suppliers and service providers
  • CCTV support and maintenance service providers

How long we retain the personal data

The Council retains footage captured by the CCTV system for a period of one month from the date the footage was captured.

Where a request for footage is received, the footage may be retained for longer pending completion of the request.

Where footage is subject to, for example a police or health and safety investigation a copy of the footage may be retained for longer for those purposes.

Your data protection rights

The General Data Protection Regulation (GDPR) gives individuals important rights, including the right to access their personal data. Click here for further information on your information rights and how to exercise them. 

Your right to make a data protection complaint to the Council

You have the right to complain to the Council if you believe we have not handled your personal data responsibly and in line with good practice.

You can raise a formal complaint via the Council’s Customer Feedback Scheme using the following link (Make a comment, compliment or complaint online) or you can contact the Council’s Data Protection Officer at Information.Management@rctcbc.gov.uk.

Your right to make a data protection complaint to the ICO

You also have the right to complain to the ICO if you are unhappy with how we have used your data. However, we encourage you to contact us first and provide us with an opportunity to look into your concern and put things right.

The ICO can be contacted:           

  • Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  • Helpline number: 0303 123 1113
  • Website: https://www.ico.org.uk